Approvals and guardrails
What your AI assistant can change through Praxis, where you review it, what happens when it's wrong, and how to block a change.
Through the Praxis CLI, your AI assistant does what you ask with your own access.
What your AI assistant can change, and what needs your approval
Praxis has no approval step of its own for Facets changes: your role decides what it can change.
| Action | On its own? | What limits it |
|---|---|---|
| Read and draft: your cloud, clusters, Facets setup and code, to explain, plan or draft a change | Yes. Nothing changes until the change is applied | The access you connect, and read-only cloud and Kubernetes commands |
| Change Facets when you ask: a resource, an override or a release | Yes, under your AI assistant's own approval settings | Your role |
| Approve a held release | Only if your role has approval authority | Your role |
| Change cloud or Kubernetes directly | Not through Praxis | The read-only access you connect, and read-only commands on Facets' side |
Pull requests your AI assistant opens wait for you to merge them.
Reviewing a change
You review in your AI assistant and in the Terraform plan.
Your AI assistant
It runs the commands, under its own approval settings.
The Terraform plan
Held and plan releases show the plan before anything changes.
When Praxis gets something wrong
A wrong change can be stopped before it applies: stop your AI assistant, or reject the held release. After it ships, revert the blueprint change in Git, or roll the resource back (Environments and releases).
Approvals and policies before a change ships
Guardrail policies (Enterprise plan) block a release that breaks your rules, and release approval holds one until someone with approval authority approves it. Both apply whoever starts the release, Praxis included.
- StartReleaseStarted by a person, a pipeline or an AI assistantchecked against your
- CheckGuardrail policiesAn Error-severity violation blocks the releasethen, if it matches your rule, held by
- HoldRelease approvalThe release waits with its Terraform plan until an approver actsonce approved, it is
- ApplyAppliedThe changes reach your cloud
A critical resource is protected: deleting it, disabling it or editing its protected fields needs a separate permission.